Read-only by design

The Pelican connection

• A user you create, with read access. Your Pelican administrator adds a user just for Zonefold. Read access to the thermostats you want monitored is enough.
• Nothing is written. Zonefold's Pelican client has no method that writes to a thermostat. It reads devices, live state, history, usage and alarms every 15 minutes.
• The password is encrypted. It is stored encrypted, with keys held by a separate service, and decrypted only in memory to read. No one can view it in Zonefold again, your own admins included.
• Nothing to install. Zonefold talks to Pelican's cloud. No software, gateway or firewall change on your network.
• Disconnect any time. Remove the Pelican user, or ask us to disconnect the site. Stored credentials are deleted when a site is disconnected.

Changes stay with people

Inside Zonefold, a person or the copilot can propose a setpoint change, and a person approves it. Someone may approve their own routine change; a copilot draft or a change to many rooms at once waits for a second person, and the database enforces these rules. Nothing is sent to your thermostats.

• Safety classes. A person who knows the building marks each room: ordinary, or protected (server and IT rooms, medical spaces, freezers, plant rooms). Unclassified and protected rooms are blocked from proposals.
• Control limits. Each site has a setpoint range, a smallest heat and cool gap, and a longest change allowed. Proposals outside them are refused.
• Two people to lower protection. Raising a room's protection takes effect at once. Lowering it waits for a second owner or admin.

Who can see what

A role applies to a scope: the whole organization, one site, one building or a single thermostat. People see only what their roles cover, and the database checks every change, so nobody can give more access than they have.

• Invitations go by email. A link works once, and only for the address it was sent to.
• Contractor delegation covers a site, a building or a device, with an end date. Revoke it at any time.
• An access list of everyone and their roles downloads as CSV for your reviews.

Sign-in and isolation

• Sign-in is handled by Auth0 (Okta). Sensitive changes, such as safety classes, control limits and owner-level roles, ask you to confirm it is you with multi-factor authentication if you signed in more than five minutes ago.
• Isolation in the database. Every table carries its organization, and row-level security filters every query for the signed-in person's organization and scope. The application's database roles cannot bypass it.
• Encrypted in transit with TLS, between your browser, Zonefold and Pelican.

Audit log

Every change is recorded with who made it and when, and with the reason wherever Zonefold asks for one: roles, invitations, delegations, safety classes, control limits, incident triage and assignments, and proposals. The log is append-only, and each entry is chained to the one before it with a keyed hash, so a removed or altered entry shows. Owners and admins can read it on the Access page.

The copilot's boundaries

• It reads only what the person asking can see, through the same scoped access as the rest of the app.
• It cites the source of every figure, so anyone can check the answer.
• Room names and alarm text from Pelican are treated as data, never as instructions.
• It can draft a proposal for an ordinary room. It never drafts for protected or unclassified rooms, and it cannot send anything to a thermostat.
• Answers come from Anthropic's API, used with settings that do not train models on your data. See the privacy policy.

Data and retention

Zonefold stores readings and settings from your thermostats, the equipment and room names Pelican reports, and the accounts of the people you invite. Data is processed in the United States.

Savings and Room use are worked out from those readings each time the page opens; no separate results are saved. Room use reads each room's hourly CO₂ from its thermostat: no people are counted or tracked.

The privacy policy lists the providers that host and process data, and your rights.

This website

zonefold.com is static HTML and CSS. It runs no scripts in your browser, sets no cookies, and has no analytics or advertising trackers. A strict Content Security Policy allows only its own styles, fonts and images, and forms that post to the site itself.

The pilot request form posts to one small server function that emails your request to our team. Nothing is stored on this website; the email passes through our email provider. The function can only write to us, never to the address you type.

Questions and reports

For a security question, a questionnaire, or to report a concern, email support@zonefold.com.